Can computer forensic tools be trusted in digital investigations?

Baofeng Energy awards contracts to KBR for Chinese methanol-to- olefins project

To identify all the hidden details that are left after or during a network incident, the computer forensics is used. The purpose of computer forensic techniques is to search, preserve and analyze information on computer systems to find potential evidence for a trial. Computers are getting more powerful day by day, so the field of computer forensics must rapidly evolve. There exist many computer forensic tools that are used to apply forensic techniques to the computer. We present our investigation with Moloch tool, that is promising for today's computers. We describe components and architecture of Moloch, its application feasibilities and hardware requirements. We present our implementation and experiments with Moloch, our performance tests and statistics and application of useful scripts for Moloch and its components. We focus on integration with other alerting tools, such as IDS, to help speed up analysis.

Digital forensics is a process of collection, identification, extraction, and documentation of electronic evidence which is used in a court of law. There are a large number of tools that help us to make this process easy and simple. In this paper, four tools have been chosen to explore and study. The best digital forensic tools have been chosen according to different parameters in each type of digital forensics. The (Stellar) basis tool and (Forensic Tool Kit) have been explored for computer forensic tools while (Network Map) has been chosen for network forensic tools and (OSFmount) has been studied as a live forensic tool. This paper also covers other types of forensic tools like Database forensic tools, O.S. forensic tools, and Mail forensic tools. The role of Artificial intelligence in Digital Forensic tools has been discussed in this paper by using both Decision Stump and Bayes net machine learning techniques. After making an investigation of the IoT device traffic dataset using these two techniques, Decision Stump gives us less accurate results compared with Bayes net.

The reliability of cyber forensic evidence acquisition is strongly influenced by the underlying operating systems, Windows, macOS, and Linux - due to inherent variations in file system structures, encryption protocols, and forensic tool compatibility. Disk forensics, one of the most widely used techniques in digital investigations, faces distinct obstacles on each platform. Windows, with its predominantly NTFS and FAT file systems, typically supports reliable disk imaging and analysis through established tools such as FTK Imager and Autopsy/Sleuth Kit. However, encryption features frequently pose challenges to evidence acquisition. Conversely, Linux environments, which rely on file systems like ext4 and XFS, generally offer greater transparency, yet the transient nature of log retention often complicates forensic analysis. In instances where anti-forensic strategies—such as encryption and compression— render traditional disk forensics insufficient, memory forensics becomes crucial. While memory forensic methodologies demonstrate robustness across Windows and Linux platforms forms through frameworks like Volatility, platform-specific difficulties persist. Memory analysis on Linux systems benefits from tools like LiME, snapshot utilities, and dd for memory acquisition; nevertheless, live memory acquisition on Linux can still present challenges. This research systematically assesses both disk and memory forensic acquisition techniques across samples representing Windows and Linux systems. By identifying effective combinations of forensic tools and configurations tailored to each operating system, the study aims to improve the accuracy and reliability of evidence collection. It further evaluates current forensic tools and highlights a persistent gap: consistently assuring forensic input reliability and footprint integrity. By integrating static analysis with temporal performance evaluations, this study emphasizes the importance of developing standardized forensic procedures to ensure the integrity and admissibility of evidence across diverse platforms. Establishing such standardized methodologies is imperative to maintaining the credibility and reliability of cyber forensic investigations in heterogeneous operating system environments.

The persistence of memory: Forensic identification and extraction of cryptographic keys

The Ext4 file system is often used by Android cell phones and by Linux distributions. As a mobile forensic expert, it is necessary to understand the structures of this file system to recover data, verify tool results, and detect anti-forensics techniques that may be present in the file system. In this chapter, we will have a deep dive into topics important for an investigation. Many digital forensic tools do not recover much from the Ext4 file system [52], and therefore we show some of the most useful Ext4 recovery techniques proposed by current research.The Ext4 file system is often used by Android1 operating systems, and also by Linux desktop distributions [14], and this file system is open source. The Ext4 file system replaces the Ext2 and Ext3, but it is mostly backwards compatible. Carrier described Ext2 and Ext3 in his File System forensic analysis book [10], which includes information also relevant for Ext4. Fairbanks describes the Ext4 file system at a low level and from a Digital Forensics perspective. This chapter will describe file system information important for mobile forensic investigators and other digital forensic experts.

Digital forensics is an area of increasing importance. An important problem is to record a checkpoint of a disk drive mounted as a file system on a host machine without disrupting the disk's normal operations. We present a checkpointing methodology for any disk that has a Unix-like file system. While our algorithm is built around the Unix file system, it can be used to checkpoint disks formatted for other file systems such as NTFS, etc. Our algorithm satisfies several correctness conditions. Currently, we are implementing the techniques on the PC platform running Linux Red Hat version 8.0.

Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. Acquisition of volatile memory is one of the vital steps of digital forensics process. Passwords data, indications of digital forensics methods, memory malware may be contained in volatile data which may overlooked by the investigator. The Success of memory acquisition mainly depends on the effectiveness of the memory acquisition tool. This paper compares memory forensics tools based on processing time and left artifacts on volatile memory. Furthermore, we examined how the processing time of the tools varies in terms of different volatile memory size. In order to conduct this work, we use the following tools: FTK Imager, Pro Discover, Nigilant32, Helix3(dd), OSForensics and Belkasoft RAM Capturer. The results show that Belkasoft RAM Capturer has the least amount of left artifacts, and it has also the lowest processing time. Moreover, this work concludes that tested tools are significantly different based on left artifacts on the volatile memory with 95% confidence level. Also, statistically, increasing the memory size × times does not increase the processing time × times of the tools.

Computer virtualization is not a new technology, it has become increasingly important because of the many advantages it offers to businesses and individuals to reduce costs, while introducing new challenges to the field of digital forensics. As virtualization continues to be adopted by more and more companies every year, malware and hacker attacks are going to have an increasing effect on virtualized systems. Therefore, the increasing growth of virtualization has created the need for a new generation of computer forensic tools and techniques to analyze these compromised systems. Because of the rapid growth of virtualization, new techniques to interact with virtual systems have been developed. Some of these techniques reduce the limitations of traditional forensics tools abilities to analyze the virtual system. Virtual Machine Introspection (VMI) is one of these techniques that have formed the basis for a number of novel approaches in the fields of cyber security and digital forensics. This paper explores how VMI improves traditional digital forensics to overcome its downfalls when used to investigate virtual machines, especially during a live analysis of the machine.

Data has become a bigger challenge to handle in mobile networks, today. In case of mobile devices data needs to be processed in large amounts so insufficient space issues may occur in case of low hardware configurations. For this, cloud platform provides ease of migrating apps to various places without giving platform dependency, space issues and also giving better data processing on low hardware costs. But is highly susceptible to malware attacks and data loss due to various factors and in case of digital data forensics becomes a greater challenge. In this paper, we present an overview of MCC and digital forensics, focusing on its key aspects and significant forensic challenges faced by digital investigators in MCC. The purpose of this paper is to provide a comprehensive understanding about forensic research challenges and re-direct researchers towards new research areas.

Formalising investigative decision making in digital forensics: Proposing the Digital Evidence Reporting and Decision Support (DERDS) framework

Acquiring a clear perspective of events and artefacts that occur over time is a challenging objective to accomplish in digital forensics. Reconstruction of the timeline of events and artefacts, which enables digital investigators to understand the timeline of digital crime and interpret the conclusion in the form of digital evidence, is one of the most paramount and challenging tasks in digital forensics. This challenging task requires the analysis of immense amounts of events because of the explosive growth of the internet, interconnected devices, and innovative technology nowadays. Various approaches have been developed during the last decade, but most of them are not able to handle huge volumes of data, explore evidence, and enhance the understandability of timelines in a competent way to assist the investigator. For this purpose, we introduce a methodology backed by an abstraction concept and forensic tools that can support investigators during the reconstruction, understanding of the timeline of events and artefacts, and interpretation of evidence by tracing the activities performed by users of the typical computer system. The Java programming language is used to implement the proposed methodology, which is object-oriented and follows the symmetry definition in software. Generally, symmetry in software can be viewed as an invariant change that aims to preserve a specific property of the system, namely its structure, behaviour, regularity, similarity, familiarity and uniformity. Similarly, the abstraction-based methodology also permits us to follow the properties of symmetry. For instance, a uniform structure is stipulated for all the sources at the particular level of abstraction, such as the number of fields to be considered to provide the abstract level of timeline. The primary purpose of this approach is to assist with the analysis of the timeline in an optimum way. This paper illustrates the approach and then focuses on conceptual aspects of the methodology. The performed experiment shows that the proposed approach enhanced the analysis of the timeline.

This paper reviews the existing methodologies and best practices for digital investigations phases like collecting, evaluating and preserving digital forensic evidence and chain of custody of cybercrimes. Cybercriminals are adopting new strategies to launch cyberattacks within modified and ever changing digital ecosystems, this article proposes that digital investigations must continually readapt to tackle cybercrimes and prosecute cybercriminals, working in international collaboration networks, sharing prevention knowledge and lessons learned. The authors also introduce a compact cyber forensics model for diverse technological ecosystems called Cyber Forensics Model in Digital Ecosystems (CFMDE). Transferring the knowledge, international collaboration, best practices and adopting new digital forensic tools, methodologies and techniques will be hereinafter paramount to obtain digital evidence, enforce organizational cybersecurity policies, mitigate security threats, fight anti-forensics practices and indict cybercriminals. The global Digital Forensics community ought to constantly update current practices to deal with cybercriminality and foreseeing how to prepare to new technological environments where change is always constant.

Is digital evidence reliable? Does digital forensics in criminal investigations uphold to fair trial principles and forensics standards? What is the impact of the increased use of science and technology in the investigation on the rights of suspects, accused, and defendants? This research attempts to address those questions through the lens of the right to a fair trial (Art. 6 ECHR). Selected fair trial guarantees are analysed in order to clarify specific evidence rules for digital investigations. These evidence rules feed into a gap analysis exemplifying unaddressed threats to the right to a fair trial rooted in the specifics of digital investigations and the underdeveloped reliability standard for digital evidence. The imminent challenges with digital evidence in practice are demonstrated in the review of the Encrochat investigation.To address the identified challenges the thesis employs action research and examines practical solutions for improvement of digital evidence reliability by integrating fair trial based evidence rules, with existing digital forensics methodology and given law enforcement requirements. As a result, a new reliability validation enabling framework for digital evidence is proposed. The practical benefits of the proposed framework for digital forensic examiners and law enforcement are tested in two case studies in cooperation with the Norwegian police.The argumentative legal analysis further explores the feasibility and implications of a new digital right to procedural accuracy to comprehensively address the significant impact of digital forensic science and technology on individuals’ rights in criminal proceedings and to serve as a legislative anchor for digital evidence reliability assurance.

Dr Paulino Ruiz-de-Clavijo from Universidad de Sevilla in Spain talks about the research behind his Letter ‘NanoFS: hardware-oriented file system’ on page 1216. Dr Paulino Ruiz-de-Clavijo During my higher education as a computer engineer I have always been interested in low-level programming and digital electronic circuits. In 1999 I started my PhD research at the University of Seville and the National Microelectronics Centre - CSIC, which I completed at the ID2 research group of the University of Seville. That period allowed me to start working with reprogrammable devices; FPGAs in particular. This technology fascinated me because it opened up the possibility to reuse my knowledge and experience in software programming to develop hardware using hardware description languages (HDLs), and I found the hardware-software codesign a great field to explore. The research in our group involves the wide field of hardware-software codesign and reconfigurable hardware. Our work is mainly focused on the design of digital embedded systems and SoC (system on chip) on FPGAs and the design of application-specific peripherals for SoC. Relating to SoCs, we have worked with open platforms like the LEON and OpenRISC soft-core microprocessors. In our group we have also developed hardware for industrial projects like a SNTP synchronisation platform based on FPGA and a frequency synchroniser for OFDM systems. We have developed a new file system called ‘nano file system’ (NanoFS) which is specially tailored to be implemented in hardware. It has been designed from scratch keeping in mind the hardware implementation limitations. The main objective is to be able to do file system operations just with digital circuits while keeping a minimum hardware footprint. The approach keeps the high level file system features and it can be used in both low level embedded systems and high-level operating systems. An all-hardware file system reader core is presented in our Letter which has been successfully implemented and tested in a low-range FPGA device. It can be included in custom designs to read data from files stored in external storage media. Most file systems are designed with two overall objectives: to be optimal for the storage medium and/or to be optimal when implemented in software. Our proposal is a hardware-friendly file system suitable for embedded systems. The file system can be used without an operating system or before the operating system is booted. File systems like FAT or EXT2 are widely used in electronic devices and SoC. The layouts of these traditional file systems are intended to be managed with software algorithms. When these algorithms are translated to HDL, a large amount of resources are necessary. There have been a few initiatives to develop file systems for embedded systems to solve these problems that simplifies data structures and improves some software routines. These file systems are written in C and supply an API for some microcontrolers but are not designed to achieve a hardware implementation. Some custom designs in hardware require dynamic configuration, such as the network configuration, calibration parameters, etc. In previous work we developed a SNTP synchronisation server designed as a full hardware solution to improve the precision. To try different configurations of these servers, we had to reprogram the FPGA device. We thought that a data file in a file system that could be accessed directly from the device hardware would be a faster and more flexible method to achieve that. We created NanoFS to solve the problems we found when we tried to access other file systems from hardware. Currently, from a software perspective, a dedicated file manager application is used to access the file system. We are working to improve a Linux native driver for NanoFS so we can access the files right from the operating system. At this moment the driver works in read-only mode. We are also migrating the file manager to the MS Windows platform. From the hardware perspective, we are developing some new hardware cores with write support. We plan to test the write support module with current solid state disks to measure the performance. Further applications we have planned to use the new file system are: data acquisition systems; boot loaders for embedded systems; and FPGA dynamic reconfiguration.